From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 30C4AC433FE for ; Sun, 9 Oct 2022 13:10:45 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S229925AbiJINKm (ORCPT ); Sun, 9 Oct 2022 09:10:42 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:46828 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S229886AbiJINKj (ORCPT ); Sun, 9 Oct 2022 09:10:39 -0400 Received: from cae.in-ulm.de (cae.in-ulm.de [217.10.14.231]) by lindbergh.monkeyblade.net (Postfix) with ESMTP id E9B1B19024 for ; Sun, 9 Oct 2022 06:10:37 -0700 (PDT) Received: by cae.in-ulm.de (Postfix, from userid 1000) id A7DCE14026A; Sun, 9 Oct 2022 15:10:36 +0200 (CEST) Date: Sun, 9 Oct 2022 15:10:36 +0200 From: "Christian A. Ehrhardt" To: Christian Brauner Cc: Tejun Heo , syzbot , gregkh@linuxfoundation.org, linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com, Yosry Ahmed Subject: [PATCH] cgroup: Fix crash with CLONE_INTO_CGROUP and v1 cgroups Message-ID: References: <000000000000385cbf05ea3f1862@google.com> <00000000000028a44005ea40352b@google.com> <20221009084039.cw6meqbvy4362lsa@wittgenstein> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <20221009084039.cw6meqbvy4362lsa@wittgenstein> Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Since commit f3a2aebdd6, Version 1 cgroups no longer cause an error when used with CLONE_INTO_CGROUP. However, the permission checks performed during clone assume a Version 2 cgroup. Restore the error check for V1 cgroups in the clone() path. Reported-by: syzbot+534ee3d24c37c411f37f@syzkaller.appspotmail.com Link: https://lore.kernel.org/lkml/000000000000385cbf05ea3f1862@google.com/ Fixes: f3a2aebdd6 ("cgroup: enable cgroup_get_from_file() on cgroup1") Signed-off-by: Christian A. Ehrhardt --- kernel/cgroup/cgroup.c | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/kernel/cgroup/cgroup.c b/kernel/cgroup/cgroup.c index b6e3110b3ea7..f7fc3afa88c1 100644 --- a/kernel/cgroup/cgroup.c +++ b/kernel/cgroup/cgroup.c @@ -6244,6 +6244,11 @@ static int cgroup_css_set_fork(struct kernel_clone_args *kargs) goto err; } + if (!cgroup_on_dfl(dst_cgrp)) { + ret = -EBADF; + goto err; + } + if (cgroup_is_dead(dst_cgrp)) { ret = -ENODEV; goto err; -- 2.34.1